CVE-2022-1641

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= unspecified, < 101.0.4951.64

References

https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.htmlRelease Notes, Vendor Advisory
https://crbug.com/1305068Exploit, Issue Tracking, Patch, Vendor Advisory
https://security.gentoo.org/glsa/202208-25Third Party Advisory
https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.htmlRelease Notes, Vendor Advisory
https://crbug.com/1305068Exploit, Issue Tracking, Patch, Vendor Advisory
https://security.gentoo.org/glsa/202208-25Third Party Advisory

Timeline

Published: Jul 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-16427.5A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a J CVE-2022-16434.8The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users CVE-2022-16444.8The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege CVE-2022-16454.8The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2022-16464.8The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privile CVE-2022-16474.8The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perfor CVE-2022-16487.2Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside t CVE-2022-16495.5Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is CVE-2022-16509.3Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.CVE-2022-16517.1A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emul CVE-2022-16527.8Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_fl CVE-2022-16534.3The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, all